Port reference
Port 5432 (TCP) – PostgreSQL
Default listener for PostgreSQL relational database connections.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
PostgreSQL listens on localhost by default; listen_addresses must be changed to expose it. Many deployments set it to 0.0.0.0 and loosen pg_hba.conf, exposing 5432 across the network.
What is port 5432 used for?
Port 5432 is the default port for PostgreSQL, one of the most popular open-source relational databases. Applications and admin tools connect here to store and query data that backs websites, apps, and analytics platforms. You will see it used by the psql command line, pgAdmin, ORMs and frameworks like Django, Rails, and Prisma, and managed services such as Amazon RDS and Supabase.
When would you open it?
Open or forward port 5432 only when an application server or database client needs to reach PostgreSQL on a different machine, ideally over a private network. If your app and database run on the same host, the database can stay on localhost and the port never needs to be opened externally.
Is it safe to open?
PostgreSQL usually holds important data and gets scanned and brute-forced when exposed to the internet, so keep it on a private network behind a firewall or VPN. See the security notes below.
How to check if this port is open
ss -tulpn | grep :5432
nmap -p 5432 <target>netstat -ano | findstr :5432
Test-NetConnection <host> -Port 5432lsof -i :5432
nmap -p 5432 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 5432 to your device's local IP, internal port 5432, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 5432/tcpsudo firewall-cmd --permanent --add-port=5432/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 5432 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 5432" -Direction Inbound -Protocol TCP -LocalPort 5432 -Action AllowSecurity & risks
Common attacks
- Credential brute force and password spraying against postgres and app roles
- Abuse of overly permissive pg_hba.conf trust rules
- Privilege abuse, including command execution via COPY PROGRAM as superuser
- SQL injection pivoting into the database engine
Hardening
- Keep listen_addresses on localhost or a private interface; never expose 5432 to the internet
- Tighten pg_hba.conf — require scram-sha-256, avoid trust auth
- Enforce strong passwords and least-privilege roles; restrict superuser use
- Require TLS for client connections and segment with firewalls
- Keep PostgreSQL patched and monitor failed logins
How to block this port
sudo ufw deny 5432/tcpsudo firewall-cmd --permanent --remove-port=5432/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 5432 -j DROPNew-NetFirewallRule -DisplayName "Block 5432" -Direction Inbound -Protocol TCP -LocalPort 5432 -Action Blocknmap snippet
nmap -p5432 --script pgsql-brute <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Is it safe to expose port 5432 to the internet?
- No. Internet-facing PostgreSQL is scanned and brute-forced. Keep listen_addresses private, tighten pg_hba.conf, require TLS, and connect over a VPN or SSH tunnel.
- What makes pg_hba.conf risky?
- It controls who can authenticate and how. A 'trust' rule on a public address lets anyone connect with no password. Use scram-sha-256 and restrict by source IP.